How to Implement ISO 27001 Annex A 5.19

Implementing ISO 27001 Annex A 5.19 Information Security in Supplier Relationships is a technical mandate to secure supply chain integrity through manual technical due diligence and contractual rigour. This process provides the business benefit of mitigating third-party risks, ensuring data sovereignty and sustained regulatory compliance across the vendor ecosystem.

ISO 27001 Annex A 5.19 Information Security in Supplier Relationships Implementation Checklist

Use this implementation checklist to achieve compliance with ISO 27001 Annex A 5.19. True security in the supply chain is achieved through rigorous technical vetting and physical verification, not by simply collecting SOC2 reports in a GRC dashboard.

1. Formalise the Supplier Security Policy

Control Requirement: A policy must be established to mitigate risks associated with supplier access to the organisation’s assets.

Required Implementation Step: Draft a bespoke Supplier Security Policy that defines minimum technical standards for any third party handling your data. Do not use a generic template; specify encryption requirements, mandatory MFA, and specific notification timeframes for security breaches that align with your internal RTO and RPO.

Minimum Requirement: A board-approved policy document that is referenced in every new supplier contract.

2. Categorise and Risk-Assess the Supplier Base

Control Requirement: All suppliers must be identified and categorised based on the risk they pose to information security.

Required Implementation Step: Build a manual Supplier Register in a controlled document. Categorise suppliers as ‘Critical’, ‘High’, or ‘Standard’ based on their level of access to your production environment or PII, and document the specific risks (e.g., data transit, geographic location) identified for each.

Minimum Requirement: A complete register of all third-party vendors with a documented risk score for each entry.

3. Conduct Manual Technical Due Diligence

Control Requirement: Information security requirements must be agreed upon with the supplier before granting access.

Required Implementation Step: Move beyond automated questionnaires. Schedule a technical call with the supplier’s Lead Engineer to verify their actual implementation of controls, such as their patch management schedule and log retention periods, rather than accepting a ‘Yes’ on a web form.

Minimum Requirement: Records of a technical interview or a signed, detailed security questionnaire verified by your IT lead.

4. Embed Security Clauses into Contracts

Control Requirement: Agreements with suppliers must include requirements to address information security risks.

Required Implementation Step: Open your Master Service Agreement (MSA) and manually insert specific security clauses. These must include the ‘Right to Audit’, mandatory breach notification within a set number of hours, and the requirement for the supplier to cascade these security obligations to their own subcontractors (N-th party risk).

Minimum Requirement: Signed contracts containing specific, non-generic security and data protection appendices.

5. Enforce the Right to Audit

Control Requirement: The organisation must be able to audit the supplier’s security controls as agreed in the contract.

Required Implementation Step: Exercise your contractual right to audit by requesting specific evidence of control effectiveness, such as redacted penetration test summaries or evidence of their last disaster recovery drill. If the supplier is high-risk, perform a manual site visit to inspect their physical security and server room access controls.

Minimum Requirement: An annual audit report or evidence of a formalised ‘Evidence Request’ sent to and fulfilled by the supplier.

6. Manage Changes to Supplier Services

Control Requirement: Changes to the provision of services by suppliers must be managed, taking account of the criticality of business information.

Required Implementation Step: Implement a manual change control process for suppliers. Whenever a supplier changes their hosting provider, API version, or key personnel, you must perform a mini-risk assessment to ensure the security posture has not been degraded by the update.

Minimum Requirement: Change logs showing that supplier-side updates were reviewed and authorised before implementation.

7. Establish Secure Remote Access Protocols

Control Requirement: Supplier access to internal systems must be controlled and monitored.

Required Implementation Step: Do not allow persistent VPN tunnels for suppliers. Configure ‘Just-In-Time’ (JIT) access where account credentials are enabled only for a specific window, and ensure all supplier activity is logged in a separate, immutable audit trail that is reviewed weekly.

Minimum Requirement: Firewall or VPN logs showing that supplier access is time-bound and restricted to specific IP addresses.

8. Monitor and Review Supplier Service Delivery

Control Requirement: The organisation must regularly monitor, review, and audit supplier service delivery.

Required Implementation Step: Hold quarterly service review meetings with critical suppliers. Manually review their performance against the security SLAs defined in the contract, and document any ‘near misses’ or minor security exceptions that occurred during the period.

Minimum Requirement: Minutes from quarterly meetings showing security performance was an explicit agenda item.

9. Plan for Secure Decommissioning and Exit

Control Requirement: Agreements must include requirements for the return or destruction of information at the end of the contract.

Required Implementation Step: Create a manual ‘Supplier Exit Checklist’. When a contract ends, you must obtain a signed ‘Certificate of Data Destruction’ from the supplier and manually revoke all digital and physical access credentials immediately.

Minimum Requirement: A completed exit checklist and signed destruction certificate for the most recently terminated supplier.

10. Address N-th Party (Sub-supplier) Risk

Control Requirement: Suppliers must be required to manage security risks across their own supply chain.

Required Implementation Step: Request a list of all sub-processors used by your primary suppliers. Manually verify where your data is actually stored (down to the data centre level) and ensure your primary supplier has signed security agreements with those sub-processors that are at least as stringent as your own.

Minimum Requirement: A documented map of sub-processors for all ‘Critical’ and ‘High-risk’ suppliers.

ISO 27001 Annex A 5.19 SaaS / GRC Platform Implementation Failure Checklist

Control Requirement	The ‘Checkbox Compliance’ Trap	The Reality Check
Technical Due Diligence	Accepting a SOC2 Type II report as a ‘Pass’ in the dashboard.	A SOC2 report is a snapshot; it doesn’t tell you if the supplier turned off MFA yesterday to ‘fix’ a developer’s login issue.
Contractual Rigour	Storing a PDF in a GRC vault and marking it as ‘Compliant’.	The tool cannot verify if the ‘Right to Audit’ clause is actually enforceable or if the liability cap is dangerously low.
N-th Party Risk	Viewing a static list of sub-processors in a vendor portal.	GRC tools don’t see when a sub-processor moves data to a different jurisdiction without notifying the primary supplier.
Remote Access	Showing a ‘Green’ status because a VPN is configured.	Automation misses the ‘service account’ created for a consultant three years ago that still has full admin rights.
Risk Assessment	Using automated ‘Security Scores’ (like BitSight or SecurityScorecard).	Scores reflect external perimeter noise, not the internal hygiene of the supplier’s actual data processing environment.
Decommissioning	Marking a vendor as ‘Inactive’ in the software.	Deactivating a record in a GRC tool does not delete your company’s database backups from the supplier’s S3 buckets.
Incident Notification	Assuming the ‘Security Notification’ email in the portal is monitored.	If a breach happens on a Saturday night, an automated dashboard won’t wake up your incident response lead; a manual escalation path will.
Service Monitoring	Uptime monitoring via a 3rd party API ping.	A supplier’s website being ‘Up’ is not the same as their security controls being ‘On’.

About the author